Hi All,
Should Magic quotes be on by default? Should be force it to be turned off?
I think it’s causing some problems with web forms and \’
Updated:
See here
http://www.webmasterstop.com/63.html
Yea with the FormProcessor snippet I had to do some funky stuff to acommodate it. I say we get turn it off.
It caused some major nightmares for me too.
Anyone else for turning off Magic quotes inside the front-end?
Any suggestions on a fast magic quote removal technique?
Here’s one that I’ve found
<?php
function undo_magic_quotes( ) {
if ( get_magic_quotes_gpc( ) ) {
$_GET = array_map_recursive('stripslashes', $_GET) ;
$_POST = array_map_recursive('stripslashes', $_POST) ;
$_COOKIE = array_map_recursive('stripslashes', $_COOKIE) ;
$_REQUEST = array_map_recursive('stripslashes', $_REQUEST) ;
}
}
if ( ! function_exists('array_map_recursive') ) {
function array_map_recursive($function, $data) {
foreach ( $data as $i => $item ) {
$data[$i] = is_array($item)
? array_map_recursive($function, $item)
: $function($item) ;
}
return $data ;
}
}
?>
Well, you know, if you turn them off, you’ve to be careful with your sql-statements that contain user submitted variables (due to the risk of sql-injection). I would suggest using the function mysql_real_escape_string within the DBAPI to create a secure way working with the database.
I see the function ’escape’ exists, but it isn’t applied on values in sql-statements. Doing that in API would keep snippet authors from writing risky code ;-)
Any opinions?
-
MODX Staff
- 10,725 Posts
Well, not sure what the best approach is in the current code base, but in Tattoo, the DB layer (supplied by Creole, which is modeled after JDBC) handles all escaping internally already (regardless of magic_quote settings), if you use the abstraction layers and avoid writing pure SQL. It uses prepared statements in conjunction with getXXXX and setXXXX methods in the DB layer to get and set specific value types (where XXXX is String, Int, etc.), handling all type conversion and validation. That’s one of the major advantages of a DB abstraction layer, and proper object model, to keep component developers from needing to write code that is susceptible to SQL injection attacks.
Applying the mysql_real_escape_string might work, but there are places where SQL is being used in raw form, even within the snippets, and so applying this technique to the DBAPI would not address the problem completely; however, it’s at least a good start and an important option for component developers to take advantage of.
That’s true NetNoise. IMO it’s up to the developer to use the functions that are available to prevent such attacks.
Will be looking into this some more.
